Dashboard › publish › Distillation
37e53fc7-fc4a-4924-a029-35f733c07eaa["lore_tm_v1_7jmoQRCkVSUqJmGGGxtkFYOkTJLB_Tkh016ZQ_JquVk"]
src/publish/__tests__/auto-approval-workflow.js contains 2 tests: (1) .github/workflows/auto-approve.yml must run node src/publish/record-auto-approval-attestation.js before --add-label accepted; (2) the “Post automated approval attestation” step must use GH_TOKEN: ${{ github.token }} before labeling, while the later label operation uses GH_TOKEN: ${{ steps.token.outputs.token }}.src/publish/__tests__/ci-poller-workflow.js reads both .github/workflows/ci-poller.yml and .github/workflows/ci-poller-dispatch.yml and contains 3 tests covering trusted checkout ordering, protected manual recovery, and repository-dispatch attempt validation.src/publish/__tests__/ci-poller-workflow.js requires .github/workflows/ci-poller.yml to run a pinned 40-character-SHA actions/checkout step named Get publish code, with ref: ${{ github.event.repository.default_branch }}, before the Get auth token step..github/workflows/ci-poller.yml to accept repository_dispatch type [ci-poller] and a workflow_run from [Run CI Status Poller] only when its conclusion is success and head_branch equals github.event.repository.default_branch; direct workflow_dispatch: must be absent..github/workflows/ci-poller-dispatch.yml must contain workflow_dispatch:, permissions: {}, and environment: production, and must contain neither secrets. nor repository_dispatch:.Get auth token; the accepted ATTEMPT format is ^(0|[1-5][0-9])$, allowing integers 0–59 without leading zeroes except 0.ATTEMPT: ${{ github.event_name == 'repository_dispatch' && steps.dispatch-attempt.outputs.value || '0' }}, incrementing with attempt=$((10#$ATTEMPT + 1)), and dispatching through gh api --method POST "repos/$GITHUB_REPOSITORY/dispatches" --input -.src/publish/__tests__/publish-workflow.js contains 2 tests: .github/workflows/publish.yml must place Revalidate approval attestation after Set targets and before Publish using Craft, with REQUIRE_CI_READY_ATTESTATION: "true"; Craft must be pinned as docker://getsentry/craft@sha256: followed by exactly 64 lowercase hexadecimal characters.src/publish/__tests__/record-ci-ready-attestation.js contains 3 tests for recordCiReadyAttestation() from src/publish/record-ci-ready-attestation.js.recordCiReadyAttestation() must bind issue 123 in getsentry/publish to the current accepted event and the authenticated app that will add ci-ready; for title publish: getsentry/sentry-javascript@10.0.0, accepted actor contractor, event ID "100", and authenticated login sentry-internal-app[bot], parseCiReadyAttestation() must return acceptedActor: "contractor", acceptedEventId: "100", ciReadyActor: "sentry-internal-app[bot]", the same title, and a string requestDigest.recordCiReadyAttestation() must throw The approval changed before CI could be marked ready if the fetched issue title changes from publish: getsentry/sentry-javascript@10.0.0 to publish: getsentry/sentry-python@10.0.0.recordCiReadyAttestation() must also throw The approval changed before CI could be marked ready when expectedAcceptedEvent is { actor: "contractor", eventId: "100" } but the current latest accepted event has ID "200".src/publish/__tests__/validate-approval-attestation.js contains 9 tests for validateApprovalAttestation() and restores all Vitest mocks with vi.restoreAllMocks() after each test.validateApprovalAttestation() accepts an open issue with the accepted label when its current accepted event actor/event ID (contractor/"100") matches a createApprovalAttestation() proof posted by github-actions[bot].false if the issue title changes after attestation, including a change from publish: getsentry/sentry-javascript@10.0.0 to publish: getsentry/sentry-python@10.0.0.false if the issue body changes after attestation, including adding Merge target: main\n\n- [ ] npm.false if the accepted label is removed or the issue state changes from open to closed.accepted label event as authoritative: an attestation for event ID "100" is invalid after event ID "200" re-adds accepted.expectedAcceptedEvent is { actor: "contractor", eventId: "100" }, approval validation returns false if the supplied attestation instead targets later accepted event ID "200".requireCiReadyAttestation: true, validation succeeds only when the issue has both accepted and ci-ready, the approval proof targets the current accepted event, the CI-ready proof targets that same accepted event, both proofs are comments by github-actions[bot], and the actual ci-ready label event actor is sentry-internal-app[bot].ci-ready label is rejected: even with a CI-ready attestation naming sentry-internal-app[bot], validation returns false when the actual ci-ready label event actor is contractor.src/publish/__tests__/workflow-action-pinning.js dynamically enumerates every .yml file in .github/workflows and requires every uses: actions/...@revision reference to use exactly a 40-character lowercase hexadecimal commit SHA.src/publish/__tests__/workflow-action-pinning.js requires every workflow except .github/workflows/ci-poller-dispatch.yml to omit workflow_dispatch:.SECRET_BEARING_JOBS in src/publish/__tests__/workflow-action-pinning.js requires environment: production for .github/workflows/auto-approve.yml job auto-approve, .github/workflows/ci-poller.yml job check-ci, .github/workflows/cocoapods-keepalive.yml job keepalive, and .github/workflows/publish.yml jobs waiting-for-ci and publish..github/workflows/ci-poller-dispatch.yml as the only protected manual-dispatch relay and require it to contain workflow_dispatch:, permissions: {}, and environment: production while containing no secrets. references.